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CLAIM AMENDMENTS 

1. (Currently Amended) A method of monitoring a network switch having a plurality of 
regular ports between which network traffic data packets are forwarded and an external mirror port, 
comprising: 

selecting at least one of said regular ports; 

mirroring a data packet of the said selected port to said external mirror port; 
extracting the network address information of said mirrored data packet; 
determining port information of said network address informatio n in response to said 
network address information extraction ; and 

performing network analysis of said network switch. 

2. (Currently Amended) The method of claim 1, wherein said port information comprises 
physical information of said network address information in said n e twork switch . 

3. (Previously Presented) The method of claim 1, wherein said port information 
determination comprises interrogating said network switch to obtain said port information using said 
network address information. 

4. (Previously Presented) The method of claim 3, wherein said interrogation comprises: 
sending a first request to said network switch requesting a port index corresponding to said 

network address information; and 

sending a second request to said network switch requesting said port information 
corresponding to said port index. 
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5. (Currently Amended) The method of claim 4 claim L wherein said first r e quest and said 
second r e qu e st ar e SNMP r e qu e sts network address information extraction and said port information 
determination are performed in an external monitor device . 

6. (Cancelled). 

7. (Currently Amended) The method of claim 1 claim 4 , wherein said port information 
determination comprises placing said mirrored data packet in a first-in-first-out buffer waiting for 
responses from said network switch. 

8. (Currently Amended) The method of claim 7, wherein said port information determination 
further comprises releasing said mirrored data packet from said first-in-first-out buffer after said 
network switch responds to said SNMP requests. 

9. (Previously Presented) The method of claim 7, wherein said port information 
determination further comprises releasing said mirrored data packet from said first-in-first-out buffer 
after a predetermined period of time. 

10. (Previously Presented) The method of claim 1, further comprising maintaining at least 
one lookup table correlating said network address information with said port information. 

11. (Previously Presented) The method of claim 1, wherein said network address information 
comprises a source address of said mirrored data packet. 

12. (Previously Presented) The method of claim 1, wherein said network address information 
comprises a destination address of said mirrored data packet. 

13. (Previously Presented) The method of claim 1, wherein said network switch is a routing 

switch. 

14. (Currently Amended) A method to monitor a network switch, comprising: 
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externally obtaining at least a portion of data packets being handl e d by received at said 
network switch, wherein each of said data packets comprises network address information; 

extracting said network address information from said obtained portion of data packets; 

determining port information of said network address information in response to said 
network address information extraction ; and 

performing network analysis of said network switch using said port information. 

15. (Currently Amended) The method of claim 14, wherein said port information comprises 
physical information of said network addr e ss information in said n e twork switch . 

16. (Currently Amended) The method of claim 14, wherein said network switch comprises a 
plurality of regular ports and a mirror port, said mirror port being able to mirror network traffic for at 
least one of said regular ports, wherein said portion of data packets are obtained from said mirror 
port. 

17. (Previously Presented) The method of claim 14, wherein said network address 
information comprises source addresses. 

18. (Previously Presented) The method of claim 14, wherein said network address 
information comprises destination addresses. 

19. (Currently Amended) The method of claim 14, wherein said network switch comprising 
comprises a plurality of regular ports, wherein said portion of data packets are obtained by passively 
tapping at least one of said regular ports. 

20. (Currently Amended) The method of claim 14, wherein said port information 
determination comprises interrogating said network switch to obtain said port information using said 
network address information. 
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2 1 . (Previously Presented) The method of claim 20, wherein said interrogatio n comprises : 
sending a first request to said network switch requesting a port index corresponding to said 

network address information; and 

sending a second request to said network switch requesting said port information 
corresponding to said port index. 

22. (Currently Amended) The method of claim 21 claim 14 , wherein said first requ e st and 
said second request ar e SNMP requ e sts network address information extraction and said port 
information determination are performed in an external monitor device . 

23. (Currently Amended) The method of claim 21, wherein said port information 
determination comprises placing said obtained portion of data packets in a first-in-first-out buffer 
waiting for responses from said network switch. 

24. (Currently Amended) The method of claim 23, wherein said port information 
determination further comprises releasing said a data packet from said first-in-first-out buffer after 
said network switch responds to said first and second requests. 

25. (Currently Amended) The method of claim 23, wherein said port information 
determination further comprises releasing said a data packet from said first-in-first-out buffer after a 
predetermined period of time. 

26. (Previously Presented) The method of claim 14, further comprising maintaining at least 
one lookup table correlating said network address information with said port information. 

27. (Currently Amended) The method of claim 14, wherein said network switch is a routing 
switeh network address information extraction and said port information determination are 
performed in an external monitor device . 
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28. (Currently Amended) A method to monitor a network switch, comprising: 
externally obtaining at least a portion of data packets being handl e d by received at said 

network switch, wherein each of said data packets comprises network address information; 

extracting said network address information from said obtained portion of data packets; and 
determining port information of said network address informatio n in response to said 

network address information extraction . 

29. (Previously Presented) The method of claim 28, further comprising performing network 
analysis of said network switch using said port information. 

30. (Currently Amended) The method of claim 28, wherein said port information comprises 
physical information of said network address information in said n e twork switch . 

3 1 . (Currently Amended) The method of claim 28, wherein said port information compris e s 
physical information of naid network address information in said network switch said network 
address information extraction and said port information determination is performed in an external 
monitoring device . 

32. (Currently Amended) The method of claim 28, wherein said network switch having 
comprises a plurality of regular ports and a mirror port, said mirror port being able to mirror network 
traffic for at least one of said regular ports, wherein said portion of data packets are obtained from 
said mirror port. 

33. (Previously Presented) The method of claim 28, wherein said network address 
information comprises source addresses. 

34. (Previously Presented) The method of claim 28, wherein said network address 
information comprises destination addresses. 
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35. (Currently Amended) The method of claim 28, wherein said network switch comprising 
comprises a plurality of regular ports, wherein said portion of data packets are obtained by passively 
tapping at least one of said regular ports. 

36. (Currently Amended) The method of claim 28, wherein said port information 
determination comprises interrogating said network switch to obtain said portion of p ort information 
using said network address information. 

37. (Currently Amended) The method of claim 36, wherein said interrogatio n comprises : 
sending a first request to said network switch requesting a port index corresponding to said 

network address information; and 

sending a second request to said network switch requesting said port information 
corresponding to said port index. 

38. (Previously Presented) The method of claim 37, wherein said first request and said 
second request are SNMP requests. 

39. (Currently Amended) The method of claim 37, wherein said port information 
determination comprises placing said obtained portion of data packets in a first-in-first-out buffer 
waiting for responses from said network switch. 

40. (Currently Amended) The method of claim 39, wherein said port information 
determination further comprises releasing said a data packet from said first-in-first-out buffer after 
said network switch responds to said first and second requests. 

41. (Currently Amended) The method of claim 39, wherein said port information 
determination further comprises releasing said a data packet from said first-in-first-out buffer after a 
predetermined period of time. 
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42. (Previously Presented) The method of claim 28, further comprising maintaining at least 
one lookup table correlating said network address information with said port information. 

43. (Previously Presented) The method of claim 28, wherein said network switch is a routing 

switch. 

44. (Currently Amended) The method of claim 28, further comprising associating fee said 
port information with information contained in the said obtained portion of data packets. 

45. (Previously Presented) The method of claim 44, further comprising performing network 
analysis of said network switch using said port information and associated data packet information. 
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